CISA Orders Federal Agencies to Patch Exploited Citrix NetScaler RCE Flaw
Summary
CISA added CVE-2026-8452 to its KEV Catalog and ordered U.S. federal civilian agencies to patch affected NetScaler ADC/Gateway appliances by Aug. 29. Researchers report active web-shell attacks; watchTowr demonstrated root-level RCE, while Citrix previously cited DoS.
Key points
- CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch agencies to patch by August 29 under BOD 26-04.
- The memory-overflow flaw affects NetScaler ADC and NetScaler Gateway appliances configured with Gateway VPN or AAA virtual servers.
- watchTowr demonstrated that exploitation can enable remote code execution as root; Citrix had previously described denial-of-service impact and said it had not observed unmitigated exploitation.
- Researchers reported active “pray and spray” attacks deploying web shells, but CISA did not provide details about the attacks.
- Shadowserver tracks more than 22,000 exposed NetScaler ADC appliances and nearly 1,800 Gateway instances; the counts do not establish how many are vulnerable or unpatched.
Article Details
- Vulnerability Types
- Memory overflow
- Remote code execution
- Denial of service
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown